ldap-upstream/internal/ldap/bleve_mapper_test.go

package ldap

import (
	"testing"

	"github.com/vjeantet/goldap/message"
)

func TestBuildBleveQuery(t *testing.T) {
	s := &server{l: testLogger()}

	cases := []struct {
		name   string
		filter message.Filter
		want   string
	}{
		{
			name:   "equality on uid",
			filter: berEqualityFilter(t, "uid", "jsmith"),
			want:   `ID:"jsmith"`,
		},
		{
			name:   "equality on cn",
			filter: berEqualityFilter(t, "cn", "admins"),
			want:   `Name:"admins"`,
		},
		{
			name:   "attribute present",
			filter: berPresentFilter(t, "uid"),
			want:   "ID:*",
		},
		{
			name: "or of two matches",
			filter: berOrFilter(t,
				berRawEquality("uid", "jsmith"),
				berRawEquality("uid", "jdoe"),
			),
			want: `(ID:"jsmith" ID:"jdoe")`,
		},
		{
			name: "and of two matches",
			filter: berAndFilter(t,
				berRawEquality("uid", "jsmith"),
				berRawPresent("uid"),
			),
			want: `(+ID:"jsmith" +ID:*)`,
		},
		{
			name:   "prefix substring",
			filter: berSubstringFilter(t, "uid", "js", nil, ""),
			want:   "ID:js*",
		},
		{
			name:   "suffix substring",
			filter: berSubstringFilter(t, "uid", "", nil, "smith"),
			want:   "ID:*smith",
		},
		{
			name:   "contains substring",
			filter: berSubstringFilter(t, "uid", "", []string{"mitt"}, ""),
			want:   "ID:*mitt*",
		},
		{
			name:   "prefix and suffix",
			filter: berSubstringFilter(t, "uid", "jo", nil, "th"),
			want:   "ID:jo*th",
		},
		{
			name: "and with a nested negation",
			filter: berAndFilter(t,
				berRawPresent("uid"),
				berElement(0xa2, berRawEquality("uid", "guest")),
			),
			want: `(+ID:* -(ID:"guest"))`,
		},
		{
			name: "nested boolean groups",
			filter: berAndFilter(t,
				berRawEquality("uid", "jsmith"),
				berRawOr(t, berRawEquality("uid", "jdoe"), berRawPresent("uid")),
			),
			want: `(+ID:"jsmith" +(ID:"jdoe" ID:*))`,
		},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got, err := s.buildBleveQuery(tc.filter)
			if err != nil {
				t.Fatalf("unexpected error: %s", err)
			}
			if got != tc.want {
				t.Errorf("got %q, want %q", got, tc.want)
			}
		})
	}
}

// Assertion values are parsed by Bleve, so they must not be able to
// introduce extra query terms or operators.
func TestBuildBleveQueryEscapesValues(t *testing.T) {
	s := &server{l: testLogger()}

	cases := []struct {
		value string
		want  string
	}{
		{"x Name:y", `ID:"x Name:y"`},
		{`x" OR ID:"y`, `ID:"x\" OR ID:\"y"`},
		{`back\slash`, `ID:"back\\slash"`},
		{"x AND Name:admin", `ID:"x AND Name:admin"`},
	}
	for _, tc := range cases {
		got, err := s.buildBleveQuery(berEqualityFilter(t, "uid", tc.value))
		if err != nil {
			t.Fatalf("%q: unexpected error: %s", tc.value, err)
		}
		if got != tc.want {
			t.Errorf("value %q: got %q, want %q", tc.value, got, tc.want)
		}
	}

	// Wildcards must stay unquoted to keep their meaning, so values
	// that mix a wildcard with query syntax are refused outright
	// rather than passed through.
	for _, value := range []string{`x" OR ID:*`, `x* OR Name:*`, "*\x00"} {
		if got, err := s.buildBleveQuery(berEqualityFilter(t, "uid", value)); err == nil {
			t.Errorf("value %q was accepted as %q", value, got)
		}
	}
}

func TestBuildBleveQueryUnsupported(t *testing.T) {
	s := &server{l: testLogger()}

	cases := []struct {
		name   string
		filter message.Filter
	}{
		{"unsupported attribute", berPresentFilter(t, "mail")},
		{"unsupported attribute in equality", berEqualityFilter(t, "mail", "x@y.z")},
		{
			"top-level negation has nothing to exclude from",
			berNotFilter(t, berRawEquality("uid", "jsmith")),
		},
		{
			"and of only negations",
			berAndFilter(t,
				berElement(0xa2, berRawEquality("uid", "jsmith")),
				berElement(0xa2, berRawEquality("cn", "admins")),
			),
		},
		{
			"substring with inner wildcards",
			berSubstringFilter(t, "uid", "a", []string{"b", "c"}, "d"),
		},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			if got, err := s.buildBleveQuery(tc.filter); err == nil {
				t.Errorf("filter was accepted as %q", got)
			}
		})
	}
}